Home page logo
/

nanog logo nanog mailing list archives

Re: Re: FW: Worm probes
From: Frank Coluccio <fcoluccio () dticonsulting com>
Date: Tue, 18 Sep 2001 18:05:15 GMT


re  < readme.exe > :

http://www.cert.org/current/current_activity.html#port80


There is also an email vector where README.EXE is sent via email to
numerous accounts.  

It also seems to set the from address in both the envelope and
header to an address, possibly from the address book(?).  I've seen
a number of bounces come back to one of our NOC addresses, and a
couple of reports from humans. :(

Rob




  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault